T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:249
- Finding
- Unpinned Third-Party CLI Execution with External File Upload<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 249–255 **Vulnerability Type**: Unpinned runtime dependency and external data transfer **Risk Level**: Medium ### Vulnerable Code ```bash URL=$(npx @wavespeed/cli upload ./generated.png --json | jq -r .url) # 2. Edit to remove branding PROMPT="Remove all text and brand logos from the image. Keep everything else identical — same lighting, pose, composition, colors. Clean unbranded surface." npx @wavespeed/cli run bytedance/seedream-v4.5/edit \ -i prompt="$PROMPT" \ -i images="[\"$URL\"]" \ --json --download "./clean-{index}.{ext}" ``` The same unsafe dependency-execution and upload pattern is repeated in `references/brand-hallucination-fix.md`, lines 31–39. ### Technical Analysis The workflow invokes `npx @wavespeed/cli` without specifying an audited package version, lockfile, or integrity hash. Consequently, the package resolved at execution time can differ from the package that was originally reviewed. If the package registry account, distribution channel, or a newly published package release is compromised, the retrieved package can execute arbitrary code under the identity running the Agent. The command also uploads a local file to an external service without requiring an explicit consent, sensitivity review, destination disclosure, or file-path restriction. Although image uploading is related to the Skill's stated image-editing workflow, unrestricted use of this pattern could transfer confidential product images or embedded metadata outside the local environment. ### Attack Path 1. The Agent loads the Skill and follows the documented brand-removal workflow. 2. The Agent executes `npx @wavespeed/cli` without a pinned version. 3. `npx` resolves the package version available from the configured package registry at runtime. 4. A compromised or unexpectedly modified package executes with the Agent process's local privileges. 5. Malicious package logic could access files, environ ...[truncated 952 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed exact version instead of resolving the current release dynamically. 2. Declare the dependency in a package manifest and commit a lockfile with integrity metadata. 3. Install dependencies in a controlled setup phase and use the locally installed binary rather than runtime `npx` retrieval. 4. Verify package provenance, publisher identity, signatures, and checksums where supported. 5. Execute the image-processing CLI in a restricted sandbox with minimal filesystem, credential, and network access. 6. Require explicit user approval before uploading any local asset. 7. Display the selected file path, destination service, and applicable retention policy before transfer. 8. Restrict uploads to files generated inside a dedicated non-sensitive output directory. 9. Remove unnecessary metadata from images before upload. 10. Provide a local-only editing option for confidential assets. ]]>